1. Field of the Invention
The present invention relates to computer networks. More particularly, the present invention relates to a computer network comprising network authentication facilities implemented in a disk drive.
2. Description of the Prior Art
Computer networks comprise a number of interconnected network devices (server computers, client computers, disk drives, printers, etc.) which communicate with one another through a network communication protocol (Ethernet, ATM, etc.). Each device is typically assigned an address which identifies the device, where the device address is used to route messages to and from the device through the network. For example, a client computer may request access to a server computer by sending a message to the server computer. The message typically comprises the address of the server computer for routing the initial message, as well as the address of the client computer for routing a reply message.
Computer networks also typically employ authentication services which manage and enforce user access rights with respect to each network device. For example, a mail server may be configured so that it is accessible only by authorized users with established accounts. The authentication facility may be implemented by each network device by storing a list of authorized users and associated authentication data (e.g., passwords). When a user sends an access request to a network device, the network device will verify that the user has the appropriate access rights. In an open environment, however, this implementation can place a substantial burden on each network device as well as complicate the administrative task required to manage the user access rights for each network device.
An alternative is to use an authentication server which maintains the user IDs and associated authentication data in a centralized authentication database. Users requesting access to a particular network device must first be authenticated by the authentication server. Once authenticated, the authentication server transmits device access data to the user's client computer which is then used to access the network device. This approach is employed by the Kerberos authentication service developed as part of Project Athena at MIT. An overview of the Kerberos authentication service is provided by William Stallings in a text book entitled Cryptography and Network Security, 2nd edition, 1999, 1995 by Prentice Hall, pp. 323–353, which is herein incorporated by reference.
FIG. 1 illustrates the Kerberos authentication service in a computer network comprising a plurality of interconnected network devices including an authentication server 2, a network server 4 (e.g., a mail or file server), and a local area network (LAN) 6, all of which communication through a network routing facility 10. The authentication server 2 is configured by a person 12 (a system administrator) with the user access data associated with each of the network devices. For example, the system administrator 12 may input a plurality of user identifiers and associated passwords together with the user's access rights to the plurality of network devices. This information is stored in a central authentication database in non-volatile memory, for example, in disk drive 14.
The authentication server 2 will typically authenticate the system administrator 12 before allowing any modifications to the central authentication database. The system administrator 12 provides personal authentication data to the authentication server 2 known only to the system administrator, such as a password, voiceprint, fingerprint, etc. The authentication server 2 authenticates the system administrator 12 by comparing the received personal authentication data to authentication data stored locally (e.g., on disk drive 14).
When a user (e.g., user 16) requests access to one of the network devices (e.g., network server 4), the user 16 presents a user ID together with an access request to the authentication server 2 through the user's client computer 18 via the network routing facility 10. The authentication server 2 evaluates the authentication database to determine whether the user ID has been granted the access rights requested. If so, the authentication server 2 transmits, via the network routing facility 10, device access data to the user's client computer 18, and the client computer 18 uses the device access data to access the network server 4.
The network server 4 shares a secret key with the authentication server 2 which is used to enforce the access rights contained in the central authentication data base. The network server 4 uses the secret key to decrypt the device access data received in a device access request; if the decrypted access data is authentic, then the request is serviced, otherwise the request is denied.
The device access data is typically encrypted when transmitted from the authentication server 2 to the client computer 18, and when transmitted from the client computer 18 to the network server 4. With advanced cryptography, it is extremely difficult to decipher an encrypted message, even if intercepted by an attacker, without the secret key used to decrypt the message. Thus, attackers are now focusing their efforts on the network devices involved in the secure transactions (e.g., the authentication server, client computers, network servers, etc.) in an attempt to discover the plaintext data before encryption or after decryption, or to discover information that will help reveal the secret cryptographic keys. To this end, an attacker may physically probe a network device using special software, such as debuggers or decompilers, or special hardware, such as logic analyzers or in-circuit emulators. An attacker may also perform a remote attack on a network device using a virus program which invades the device's operating system to reveal protected information. For example, a virus may be attached to an email and transmitted to a network device through the network routing facility 10.
The authentication server 2 of FIG. 1 is susceptible to physical probing attacks as well as remote virus attacks since the access control management is performed by a conventional operating system running on a conventional central processing unit (CPU). Similarly, network devices, such as the network server 4, are susceptible to attack since they enforce access control at the operating system level using a conventional CPU. In addition, the central authentication database configured by the system administrator 12 as well as the cryptographic keys shared with the network devices are susceptible to attack if stored in plaintext form. For example, an attacker may probe the disk drive 14 attached to the authentication server 2 or the disk drive 20 attached to network server 4 in an attempt to discover the user access data and/or the secret cryptographic keys stored in plaintext form.
There is, therefore, a need to improve the security of authentication services for computer networks, particularly with respect to the authentication server and the secret keys shared with the network devices.